Confluence

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:48 AM UTC
• Version: 1.1.0

Overview

This Confluence skill is a straightforward wrapper around a Confluence CLI, with expected but sensitive access to Confluence content and credentials.

Install only after you trust the confluence-cli npm package, preferably pin a reviewed version, and use a Confluence account or token with the minimum permissions needed. Treat create/update commands as live changes to Confluence and export commands as writing potentially sensitive documentation to local disk.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unpinned Globally Installed CLI Handles a Sensitive Confluence API Token

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16–38
Vulnerability Type: Unpinned third-party dependency with access to credentials
Risk Level: Medium

Vulnerable Code

markdown

**Step 1: Install the CLI**

```bash
npm install -g confluence-cli

Step 2: Get an API token

1. Go to https://id.atlassian.com/manage-profile/security/api-tokens
2. Click "Create API token"
3. Give it a label (e.g., "confluence-cli")
4. Copy the token

Step 3: Configure the CLI

bash

confluence init

When prompted, enter:

• Domain: yourcompany.atlassian.net (without https://)
• Email: Your Atlassian account email
• API token: Paste the token from Step 2

text

The skill metadata also declares the dependency without a version pin:

```yaml
metadata: {"clawdbot":{"emoji":"📄","primaryEnv":"CONFLUENCE_TOKEN","requires":{"bins":["confluence"],"env":["CONFLUENCE_TOKEN"]},"install":[{"id":"npm","kind":"node","package":"confluence-cli","bins":["confluence"],"label":"Install confluence-cli (npm)"}]}}

SKILL.md line 129 additionally states that configuration is stored locally:

markdown

- Config is stored at `~/.confluence-cli/config.json`

Technical Analysis

The skill directs users to install confluence-cli globally from npm without specifying an exact reviewed version or package integrity information. The installed executable is subsequently trusted with an Atlassian account email and Confluence API token.

Because the version is not pinned, the effective code installed by this instruction can change after the skill has been reviewed. A compromised maintainer account, malicious future release, package ownership transfer, or registry-level supply-chain incident could cause users to install attacker-controlled code. A global npm installation may also run package lifecycle scripts with the privileges of the invoking user.

No evidence establishes t ...[truncated 1861 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact, reviewed version, such as confluence-cli@x.y.z, in both the metadata and installation instructions.
2. Verify that the npm package is controlled by the expected publisher and corresponds to the repository referenced by the skill homepage.
3. Document package provenance and integrity verification, such as npm provenance attestations, published checksums, or a reviewed lockfile.
4. Prefer a project-local, lockfile-backed installation over a global installation to reduce system-wide exposure and improve reproducibility.
5. Review package lifecycle scripts and transitive dependencies before approving a version.
6. Use an Atlassian identity with only the Confluence permissions required for the intended operations. Avoid administrative or broadly privileged accounts.
7. Document where and how the token is stored, ensure configuration files have restrictive filesystem permissions, and prevent tokens from entering logs, shell history, source control, or exported content.
8. Provide token rotation and immediate revocation procedures for suspected compromise.
9. Where supported, use short-lived or narrowly scoped credentials rather than a long-lived general-purpose API token.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill includes commands that create and update Confluence pages and export page contents to the local filesystem, but it does not clearly warn that these actions have side effects on remote data or local disk. In an agent context, this increases the chance of unintended page modification, data leakage, or writing sensitive content to local paths when a user expected read-only behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.